How to find the crash point: Android Native crash

[#1]

There is a very quick way to find out which line cause the crash in logcat,

Generally, if some native service crashes, look in the crash log in logcat like this:

I/DEBUG ( 2253): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***

I/DEBUG ( 2253): Build fingerprint: 'freescale/sabresd_6dq/sabresd_6dq:4.0.4/R13.3-rc3/eng.b18293.20120710.124535:user/test-keys'

I/DEBUG ( 2253): pid: 3043, tid: 3080 >>> /system/bin/mediaserver <<<

I/DEBUG ( 2253): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr deadbaad

I/DEBUG ( 2253): r0 deadbaad r1 00000001 r2 a0000000 r3 00000000

I/DEBUG ( 2253): r4 00000000 r5 00000027 r6 00bfd370 r7 40c1ef18

I/DEBUG ( 2253): r8 00004349 r9 00000000 10 000003f5 fp 00000000

I/DEBUG ( 2253): ip ffffffff sp 418876a0 lr 400ff1b5 pc 400fb91c cpsr 60000030

I/DEBUG   ( 2253):  ip ffffffff  sp 418876a0  lr 400ff1b5  pc 400fb91c  cpsr 60000030

We can see it’s possibly related to some code that we debugged, but don’t know exactly where or which line of code,

Android has a tool to convert this log to a more precise log. As a quick example, if you got this crash in logcat:

F/libc ( 3043): Fatal signal 11 (SIGSEGV) at 0xdeadbaad (code=1)

I/DEBUG ( 2253): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***

I/DEBUG ( 2253): Build fingerprint: 'freescale/sabresd_6dq/sabresd_6dq:4.0.4/R13.3-rc3/eng.b18293.20120710.124535:user/test-keys'

I/DEBUG ( 2253): pid: 3043, tid: 3080 >>> /system/bin/mediaserver <<<

I/DEBUG ( 2253): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr deadbaad

I/DEBUG ( 2253): r0 deadbaad r1 00000001 r2 a0000000 r3 00000000

I/DEBUG ( 2253): r4 00000000 r5 00000027 r6 00bfd370 r7 40c1ef18

I/DEBUG ( 2253): r8 00004349 r9 00000000 10 000003f5 fp 00000000

I/DEBUG ( 2253): ip ffffffff sp 418876a0 lr 400ff1b5 pc 400fb91c cpsr 60000030

I/DEBUG ( 2253): d0 3e4ccccd00000000 d1 7e37e43c3e4ccccd

I/DEBUG ( 2253): d2 0000004042000000 d3 4200000000000000

I/DEBUG ( 2253): d4 3ff0000000000000 d5 3ff0000000000000

I/DEBUG ( 2253): d6 4220000041300000 d7 3e4ccccd3e4ccccd

I/DEBUG ( 2253): d8 000000000000685d d9 00000000010bee7c

I/DEBUG ( 2253): d10 0000000000000000 d11 0000000000000000

I/DEBUG ( 2253): d12 0000000000000000 d13 0000000000000000

I/DEBUG ( 2253): d14 0000000000000000 d15 0000000000000000

I/DEBUG ( 2253): d16 0000000000000000 d17 3ff0000000000000

I/DEBUG ( 2253): d18 7e37e43c8800759c d19 0000000000000000

I/DEBUG ( 2253): d20 bfe0000000000000 d21 405443dab91ed79f

I/DEBUG ( 2253): d22 0000000000000000 d23 3f40624dd2f1a9fc

I/DEBUG ( 2253): d24 7fff80007fff0000 d25 3f6328e1cb8c85e0

I/DEBUG ( 2253): d26 0000000000000000 d27 0000000000000000

I/DEBUG ( 2253): d28 0000000000000000 d29 0000000000000000

I/DEBUG ( 2253): d30 0000000000000000 d31 0000000000000000

I/DEBUG ( 2253): scr 28000010

I/DEBUG ( 2253):

I/DEBUG ( 2253): #00 pc 0001791c /system/lib/libc.so

I/DEBUG ( 2253): #01 pc 00003f3e /system/lib/libcutils.so (__android_log_assert)

I/DEBUG ( 2253): #02 pc 0006c436 /system/lib/libstagefright.so (_ZN7android8OMXCodec16drainInputBufferEPNS0_10BufferInfoE)

I/DEBUG ( 2253): #03 pc 0006cbc2 /system/lib/libstagefright.so (_ZN7android8OMXCodec17drainInputBuffersEv)

I/DEBUG ( 2253): #04 pc 0006f570 /system/lib/libstagefright.so (_ZN7android8OMXCodec4readEPPNS_11MediaBufferEPKNS_11MediaSource11ReadOpti

onsE)

I/DEBUG ( 2253): #05 pc 00051aba /system/lib/libstagefright.so (_ZN7android11AudioPlayer5startEb)

I/DEBUG ( 2253): #06 pc 0005411e /system/lib/libstagefright.so (_ZN7android13AwesomePlayer18startAudioPlayer_lEb)

I/DEBUG ( 2253): #07 pc 0005554a /system/lib/libstagefright.so (_ZN7android13AwesomePlayer6play_lEv)

I/DEBUG ( 2253): #08 pc 000558e0 /system/lib/libstagefright.so (_ZN7android13AwesomePlayer4playEv)

I/DEBUG ( 2253): #09 pc 00027f4e /system/lib/libmediaplayerservice.so (_ZN7android17StagefrightPlayer5startEv)

I/DEBUG ( 2253): #10 pc 00024dda /system/lib/libmediaplayerservice.so (_ZN7android18MediaPlayerService6decodeEixxPjPiS2_)

I/DEBUG ( 2253):

I/DEBUG ( 2253): code around pc:

I/DEBUG ( 2253): 400fb8fc 4623b15c 2c006824 e026d1fb b12368db \.#F$h.,..&..h#.

I/DEBUG ( 2253): 400fb90c 21014a17 6011447a 48124798 24002527 .J.!zD.`.G.H'%.$

I/DEBUG ( 2253): 400fb91c f7f47005 2106ee22 eebef7f5 f04fa901 .p.."..!......O.

I/DEBUG ( 2253): 400fb92c 460a5380 93032006 94029401 ea7af7f5 .S.F. ........z.

I/DEBUG ( 2253): 400fb93c 4622a905 f7f52002 f7f4ea84 2106ee0e .."F. .........!

I/DEBUG ( 2253):

I/DEBUG ( 2253): code around lr:

I/DEBUG ( 2253): 400ff194 41f0e92d 4c0c4680 447c2600 68a56824 -..A.F.L.&|D$h.h

I/DEBUG ( 2253): 400ff1a4 e0076867 300cf9b5 dd022b00 47c04628 gh.....0.+..(F.G

I/DEBUG ( 2253): 400ff1b4 35544306 37fff117 6824d5f4 d1ee2c00 .CT5...7..$h.,..

I/DEBUG ( 2253): 400ff1c4 e8bd4630 bf0081f0 00028346 41f0e92d 0F......F...-..A

I/DEBUG ( 2253): 400ff1d4 9004b086 f602fb01 460c461f 46154814 .........F.F.H.F

I/DEBUG ( 2253):

I/DEBUG ( 2253): memory map around addr deadbaad:

I/DEBUG ( 2253): becef000-bed10000 [stack]

I/DEBUG ( 2253): (no map for address)

I/DEBUG ( 2253): ffff0000-ffff1000 [vectors]

I/DEBUG ( 2253):

You can see it’s related to which lib, but don’t know which line.

So, let’s go to your source code, for example:

mydroid;

after do

$. build/envsetup.sh$ lunch sabresd_6dp-eng

$ development/scripts/stack

Then you have a prompt:

Reading native crash info from stdin

The you just copy all the crash log in above to this prompt.

And then Key in EOF (CTRL+D) in this prompt.

You will get output like this:

Reading symbols from /home/b33651/proj/ics/out/target/product/sabresd_6dq/symbols

pid: 3043, tid: 3080 >>> /system/bin/mediaserver <<<

signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr deadbaad

  r0 deadbaad r1 00000001 r2 a0000000 r3 00000000

  r4 00000000 r5 00000027 r6 00bfd370 r7 40c1ef18

  r8 00004349 r9 00000000 10 000003f5 fp 00000000

  ip ffffffff sp 418876a0 lr 400ff1b5 pc 400fb91c

Stack Trace:

  RELADDR FUNCTION FILE:LINE

  0001791c __libc_android_abort+92 /home/b33651/proj/ics/bionic/libc/unistd/abort.c:82

  00003f3e __android_log_assert+94 /home/b33651/proj/ics/system/core/liblog/logd_write.c:246

  0006c436 android::OMXCodec::drainInputBuffer(android::OMXCodec::BufferInfo*)+138 /home/b33651/proj/ics/frameworks/base/media/libstagefright/OMXCodec.cpp:3181

  0006cbc2 android::OMXCodec::drainInputBuffers()+102 /home/b33651/proj/ics/frameworks/base/media/libstagefright/OMXCodec.cpp:3125

  0006f570 android::OMXCodec::read(android::MediaBuffer**, android::MediaSource::ReadOptions const*)+136 /home/b33651/proj/ics/frameworks/base/media/libstagefright/OMXCodec.cpp:4020

  00051aba android::AudioPlayer::start(bool)+134 /home/b33651/proj/ics/frameworks/base/media/libstagefright/AudioPlayer.cpp:93

  0005411e android::AwesomePlayer::startAudioPlayer_l(bool)+70 /home/b33651/proj/ics/frameworks/base/media/libstagefright/AwesomePlayer.cpp:953

  0005554a android::AwesomePlayer::play_l()+202 /home/b33651/proj/ics/frameworks/base/media/libstagefright/AwesomePlayer.cpp:888

  000558e0 android::AwesomePlayer::play()+20 /home/b33651/proj/ics/frameworks/base/media/libstagefright/AwesomePlayer.cpp:837

  00027f4e android::StagefrightPlayer::start()+6 /home/b33651/proj/ics/frameworks/base/media/libmediaplayerservice/StagefrightPlayer.cpp:90

  00024dda android::MediaPlayerService::decode(int, long long, long long, unsigned int*, int*, int*)+206 /home/b33651/proj/ics/frameworks/base/media/libmediaplayerservice/MediaPlayerService.cpp:1428

So, you get more reason logs.

Note:

1. The Android directory must have built once.
2. The crash log better aligns with your Android build environment.

[daiane_angolini]

is it only for imx6 debug?

[JasonZhang1z]

actually, this method can be applied for all android release and all soc of IMX.

[daiane_angolini]

So, would be better to tag the file as any imx, and not for imx6 only. :smileywink:

[frodolai]

Hi Jiejing,

I tried on JB4.2.2 but it didn't work as it used to do on ICS.